Adware: Filter Results
Hallo zusammen,
habe mir vor 2 Wochen den J-Downloader2 als Freeware Version installiert und mir dabei die unerwünschte Software "Filter Results" (Virus) eingefangen.
Der Virus hat im Chrome und FireFox Browser etliche Dinge geändert wie z.B. FilterResult als Startseite und Suchmaschine festgelegt und es poppen ständig Werbebanner auf.
Als eigene Behebungsversuche (Deinstallation etc...) fehlgeschlagen sind bin ich den Anweisungen aus dem Thread http://www.trojaner-board.de/148141-...ntfernen.html" von AdminBot gefolgt.
Der FireFox Browser scheint nun wieder zu funktionieren, im Chrome dagegen tauchen die Werbebanner weiterhin auf.
Wäre Euch sehr dankbar wenn mir Jmd weiterhelfen könnte diesen nervigen Virus loszuwerden.
Vielen Dank im Voraus! :)
Anbei die LogFiles und mein Vorgehen:
1. "Filter Results" in FireFox und Chrome als Addon und Suchmaschine entfernt
2. MBAM laufen lassen Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 21.06.2015
Suchlauf-Zeit: 12:38:07
Logdatei: mbam.txt
Administrator: Ja
Version: 2.01.6.1022
Malware Datenbank: v2015.06.21.01
Rootkit Datenbank: v2015.06.15.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: DvD
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 357813
Verstrichene Zeit: 4 Min, 16 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 8
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Common Files\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\updater.exe, 4912, Löschen bei Neustart, [f560a31af496f640b4374f377c8a0bf5]
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugincontainer.exe, 1124, Löschen bei Neustart, [1144a11cc7c3f145bd2e127441c53ec2]
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\2\Plugin.exe, 4584, Löschen bei Neustart, [bb9acdf05c2e8caaa14af3933acc14ec]
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\4\Plugin.exe, 2304, Löschen bei Neustart, [b99c3687e3a7003646a5fb8b34d23cc4]
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\8\Plugin.exe, 6648, Löschen bei Neustart, [b1a44a738604f5419b50681eb353da26]
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\3\Plugin.exe, 5620, Löschen bei Neustart, [b89d4d70385273c32fbc1a6ce3239c64]
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\3\Plugin.exe, 6272, Löschen bei Neustart, [b89d4d70385273c32fbc1a6ce3239c64]
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\5\Plugin.exe, 4364, Löschen bei Neustart, [5005833a42482d096982553164a2b34d]
Module: 0
(Keine schädliche Elemente gefunden)
Registrierungsschlüssel: 18
PUP.Optional.FilterResults.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Mgr FilterResults, In Quarantäne, [f560a31af496f640b4374f377c8a0bf5],
PUP.Optional.FilterResults.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Service Mgr FilterResults, In Quarantäne, [1144a11cc7c3f145bd2e127441c53ec2],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{dd4c66b8-f943-4b10-8053-7e9ee39bba4a}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{dd4c66b8-f943-4b10-8053-7e9ee39bba4a}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{d8409f9b-c49c-432d-a7ef-f888f0b18497}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{9CBB6D98-5673-44C2-B429-45EF963301D9}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{9CBB6D98-5673-44C2-B429-45EF963301D9}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9CBB6D98-5673-44C2-B429-45EF963301D9}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{d8409f9b-c49c-432d-a7ef-f888f0b18497}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{d8409f9b-c49c-432d-a7ef-f888f0b18497}, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FFPluginHp.A, HKLM\SOFTWARE\WOW6432NODE\FFPluginHp, In Quarantäne, [a4b1efcea2e881b503e14fa715eef30d],
PUP.Optional.FilterResults.A, HKLM\SOFTWARE\WOW6432NODE\FilterResults, In Quarantäne, [f75e318c0684ec4a610ae9ab2bda49b7],
PUP.Optional.IHProtect.A, HKLM\SOFTWARE\WOW6432NODE\IHProtect, In Quarantäne, [fb5abffe6921bf77603d689f956fd52b],
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\WOW6432NODE\mystartsearchSoftware, In Quarantäne, [5afb9f1e7d0da393e5d9779748bc718f],
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB, In Quarantäne, [0c49d4e9e6a40f27c7af9982b94b5ca4],
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-3745909582-314962539-3042319223-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, [a8ad1e9fb4d6270f52f4503bda2ba060],
PUP.Optional.SweetSearch.A, HKU\S-1-5-21-3745909582-314962539-3042319223-1000\SOFTWARE\MOZILLA\EXTENDS, In Quarantäne, [7bda2e8f2b5f1d192ad0d4237390659b],
PUP.Optional.ProductSetup.A, HKU\S-1-5-21-3745909582-314962539-3042319223-1000\SOFTWARE\PRODUCTSETUP, In Quarantäne, [7dd8e2dbf09a55e1c0066c2712f3e41c],
Registrierungswerte: 5
PUP.Optional.SweetSearch.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|sweetsearch@gmail.com, C:\Users\DvD\AppData\Roaming\Mozilla\Firefox\Profiles\od9cnktp.default\extensions\sweetsearch@gmail.com, In Quarantäne, [163f823ba4e60135498b48af877cc13f]
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\SUPTAB|ptid, cor, In Quarantäne, [0c49d4e9e6a40f27c7af9982b94b5ca4]
PUP.Optional.MyStartSearch.A, HKU\S-1-5-21-3745909582-314962539-3042319223-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J&ts=1434010257&type=default&q={searchTerms}, In Quarantäne, [a8ad1e9fb4d6270f52f4503bda2ba060]
PUP.Optional.SweetSearch.A, HKU\S-1-5-21-3745909582-314962539-3042319223-1000\SOFTWARE\MOZILLA\EXTENDS|appid, sweetsearch@gmail.com, In Quarantäne, [7bda2e8f2b5f1d192ad0d4237390659b]
PUP.Optional.ProductSetup.A, HKU\S-1-5-21-3745909582-314962539-3042319223-1000\SOFTWARE\PRODUCTSETUP|tb, 0V1D1S1R1D0V1O, In Quarantäne, [7dd8e2dbf09a55e1c0066c2712f3e41c]
Registrierungsdaten: 4
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.mystartsearch.com/web/?type=ds&ts=1434010234&z=9817445238330d0eed700f8gbz2c6z7e5g3ecofo1q&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1434010234&z=9817445238330d0eed700f8gbz2c6z7e5g3ecofo1q&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J&q={searchTerms}),Ersetzt,[8cc9b8057a10ed491cb40e2fb94d0ff1]
PUP.Optional.HttpBreaker.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://www.mystartsearch.com/?type=hppp&ts=1434010250&z=0b60694ebb20086c50bdbedg3zbcezde2gce9obzbo&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1434010250&z=0b60694ebb20086c50bdbedg3zbcezde2gce9obzbo&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J),Ersetzt,[c98c209de8a2e94dc3ab69d4bd49f30d]
PUP.Optional.HttpBreaker.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.mystartsearch.com/?type=hppp&ts=1434010250&z=0b60694ebb20086c50bdbedg3zbcezde2gce9obzbo&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/?type=hppp&ts=1434010250&z=0b60694ebb20086c50bdbedg3zbcezde2gce9obzbo&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J),Ersetzt,[c1944d70c9c12412a2cc013c877fd52b]
PUP.Optional.MyStartSearch.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.mystartsearch.com/web/?type=ds&ts=1434010234&z=9817445238330d0eed700f8gbz2c6z7e5g3ecofo1q&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://www.mystartsearch.com/web/?type=ds&ts=1434010234&z=9817445238330d0eed700f8gbz2c6z7e5g3ecofo1q&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB40833J&q={searchTerms}),Ersetzt,[5cf903ba0189ef47d5fbc37a16f08080]
Ordner: 19
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate, In Quarantäne, [460ff8c5a4e685b10c52f6f4e2218b75],
PUP.Optional.IHProtectUpDate.A, C:\ProgramData\IHProtectUpDate\update, In Quarantäne, [460ff8c5a4e685b10c52f6f4e2218b75],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3, Löschen bei Neustart, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugincontainer, In Quarantäne, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins, Löschen bei Neustart, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\2, Löschen bei Neustart, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\2bak, In Quarantäne, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\3, Löschen bei Neustart, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\3bak, In Quarantäne, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\4, Löschen bei Neustart, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\4bak, In Quarantäne, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\5, Löschen bei Neustart, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\5bak, In Quarantäne, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\8, Löschen bei Neustart, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\8bak, In Quarantäne, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Common Files\f08cac26-e74f-49b4-9ff1-f081aa55e1b3, Löschen bei Neustart, [0a4bf2cbf9911f17b0e36f8513f0bc44],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Common Files\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\updater, In Quarantäne, [0a4bf2cbf9911f17b0e36f8513f0bc44],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Filter Results, In Quarantäne, [86cfefce6822979f7a1a728242c1758b],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Filter Results\Extensions, In Quarantäne, [86cfefce6822979f7a1a728242c1758b],
Dateien: 30
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Common Files\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\updater.exe, Löschen bei Neustart, [f560a31af496f640b4374f377c8a0bf5],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugincontainer.exe, Löschen bei Neustart, [1144a11cc7c3f145bd2e127441c53ec2],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\2\Plugin.exe, Löschen bei Neustart, [bb9acdf05c2e8caaa14af3933acc14ec],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\4\Plugin.exe, Löschen bei Neustart, [b99c3687e3a7003646a5fb8b34d23cc4],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\8\Plugin.exe, Löschen bei Neustart, [b1a44a738604f5419b50681eb353da26],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\3\Plugin.exe, Löschen bei Neustart, [b89d4d70385273c32fbc1a6ce3239c64],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\5\Plugin.exe, Löschen bei Neustart, [5005833a42482d096982553164a2b34d],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Filter Results\Extensions\dd4c66b8-f943-4b10-8053-7e9ee39bba4a.dll, In Quarantäne, [ca8b338af09a2d09b007353721e29a66],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugincontainer.bak, In Quarantäne, [60f5d9e4f991c076509b206656b02bd5],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\2bak\Plugin.exe, In Quarantäne, [3b1ad9e48802142292595135ca3cf709],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\3bak\Plugin.exe, In Quarantäne, [5bfa16a77416d462f4f7b1d5cc3a1ae6],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\4bak\Plugin.exe, In Quarantäne, [4114922b7218053111daed99ea1c19e7],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\5bak\Plugin.exe, In Quarantäne, [6ce96459365436009d4edda9df27c63a],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\plugins\8bak\Plugin.exe, In Quarantäne, [59fc88356426e2545992394dae58a759],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Filter Results\Uninstaller.exe, In Quarantäne, [bc9903ba6e1c221415d6dbab8e78c13f],
PUP.Optional.InstallCore.A, C:\Users\DvD\AppData\Local\Temp\13078483786323761510.exe, In Quarantäne, [65f04d7027636acc60a286e2c83a36ca],
PUP.Optional.FilterResults.A, C:\Users\DvD\AppData\Local\Temp\is1901864539\6980ABDB_stp.EXE, In Quarantäne, [20351e9f8901d85e7e6de5a10ef8837d],
PUP.Optional.MyStartSearch.A, C:\Users\DvD\AppData\Local\Temp\is1901864539\0CAC8870_stp\May12_3697_cor_mystartsearch.exe, In Quarantäne, [55006f4e6723e551b241f68eb0560df3],
PUP.Optional.PricePeep.A, C:\Users\DvD\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.pricepeep00.pricepeep.net_0.localstorage, In Quarantäne, [24315c610486c3734b9b24d2e51e8d73],
PUP.Optional.PricePeep.A, C:\Users\DvD\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.pricepeep00.pricepeep.net_0.localstorage-journal, In Quarantäne, [f362b904acde91a506e0bf37b74c857b],
PUP.Optional.MyStartSearch.A, C:\Users\DvD\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage, In Quarantäne, [df763d80cac0ad89a284e3249d678f71],
PUP.Optional.MyStartSearch.A, C:\Users\DvD\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.mystartsearch.com_0.localstorage-journal, In Quarantäne, [262fbb028604cf6768be44c340c48878],
PUP.Optional.FilterResults.A, C:\Users\DvD\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_filterresults-a.akamaihd.net_0.localstorage, Löschen bei Neustart, [7cd947767119dc5a0763e2b2897c48b8],
PUP.Optional.FilterResults.A, C:\Users\DvD\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_filterresults-a.akamaihd.net_0.localstorage-journal, Löschen bei Neustart, [5df828950684c96dbfab633124e1f709],
PUP.Optional.FilterResults.A, C:\ProgramData\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\temp, In Quarantäne, [1045526bc3c796a0d9b9be36cb38f808],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Common Files\f08cac26-e74f-49b4-9ff1-f081aa55e1b3\updater.bak, In Quarantäne, [0a4bf2cbf9911f17b0e36f8513f0bc44],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Filter Results\7za.exe, In Quarantäne, [86cfefce6822979f7a1a728242c1758b],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Filter Results\Extensions\obkmjagdoghjjdanmkmfbjlmohmopifc.crx, In Quarantäne, [86cfefce6822979f7a1a728242c1758b],
PUP.Optional.FilterResults.A, C:\Program Files (x86)\Filter Results\Extensions\{e147fccb-d953-44ab-b126-d8593cbf8db0}.xpi, In Quarantäne, [86cfefce6822979f7a1a728242c1758b],
PUP.Optional.MyStartSearch, C:\Users\DvD\AppData\Roaming\Mozilla\Firefox\Profiles\od9cnktp.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.search.selectedEngine", "mystartsearch");), Ersetzt,[63f2d5e8a1e98da99299aedec3434eb2]
Physische Sektoren: 0
(Keine schädliche Elemente gefunden)
(end)
3. ADW Cleaner laufen lassen Code:
# AdwCleaner v4.206 - Bericht erstellt 21/06/2015 um 12:54:52
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-17.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : DvD - DVD-PC
# Gestarted von : E:\Downloads\Malware Befall_Behebungsprogramme\AdwCleaner_4.206.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\DvD\AppData\Roaming\pdfforge
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E104B9E4-01BA-4AAF-9957-6A525CC5451A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E104B9E4-01BA-4AAF-9957-6A525CC5451A}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\SupDp
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Mozilla Firefox v38.0.5 (x86 de)
[od9cnktp.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.alias", "mystartsearch");
[od9cnktp.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/web/favicon.ico");
[od9cnktp.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.name", "mystartsearch");
[od9cnktp.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=dspp&ts=1434010250&z=0b60694ebb20086c50bdbedg3zbcezde2gce9obzbo&from=cor&uid=SamsungXSSDX840XEVOX120GB_S1D5NSADB408[...]
[od9cnktp.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "mystartsearch");
[od9cnktp.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.enable_search1", false);
[od9cnktp.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
-\\ Google Chrome v43.0.2357.124
*************************
AdwCleaner[R0].txt - [2742 Bytes] - [21/06/2015 12:53:22]
AdwCleaner[S0].txt - [2675 Bytes] - [21/06/2015 12:54:52]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2734 Bytes] ##########
4. JRT laufen lassen Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 7.0.3 (06.19.2015:1)
OS: Windows 7 Professional x64
Ran by DvD on 21.06.2015 at 13:22:24,78
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Chrome
[C:\Users\DvD\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\DvD\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\DvD\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\DvD\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.06.2015 at 13:24:34,51
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5. SC-Cleaner laufen lassen Code:
Shortcut Cleaner 1.3.8 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2015 BleepingComputer.com
More Information about Shortcut Cleaner can be found at this link:
hxxp://www.bleepingcomputer.com/download/shortcut-cleaner/
Windows Version: Windows 7 Professional Service Pack 1
Program started at: 06/21/2015 01:26:49 PM.
Scanning for registry hijacks:
* No issues found in the Registry.
Searching for Hijacked Shortcuts:
Searching C:\Users\DvD\AppData\Roaming\Microsoft\Windows\Start Menu\
Searching C:\ProgramData\Microsoft\Windows\Start Menu\
Searching C:\Users\DvD\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\
Searching C:\Users\Public\Desktop\
Searching C:\Users\DvD\Desktop\
Searching C:\Users\Public\Desktop\
0 bad shortcuts found.
Program finished at: 06/21/2015 01:26:50 PM
Execution time: 0 hours(s), 0 minute(s), and 0 seconds(s)
6. ESET laufen lassen Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=904f950eb95aab458d25611755d0d1bf
# end=init
# utc_time=2015-06-21 11:29:54
# local_time=2015-06-21 01:29:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24428
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=904f950eb95aab458d25611755d0d1bf
# end=updated
# utc_time=2015-06-21 11:32:13
# local_time=2015-06-21 01:32:13 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=904f950eb95aab458d25611755d0d1bf
# engine=24428
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-21 11:50:50
# local_time=2015-06-21 01:50:50 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 71 92 198995 47312697 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 1276 186517300 0 0
# scanned=164615
# found=5
# cleaned=0
# scan_time=1116
sh=3E96852495F40C83D305F24766A5B54E08763865 ft=0 fh=0000000000000000 vn="Variante von Win32/ELEX.CP evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DvD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C7KEBWWD\1[1].zip"
sh=07CEDA7E99DE9D99EBBACFD45977C0A93388990C ft=1 fh=0c0184abb6fe494c vn="Variante von Win32/InstallCore.ZO evtl. unerwünschte Anwendung" ac=I fn="C:\Users\DvD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C7KEBWWD\JDownloader2Setup[1].exe"
sh=03BA1909F384E6C2AC7249735D7F35A4A8E45480 ft=1 fh=d761ee346fb17777 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\Install\mp3DirectCut - CHIP-Downloader.exe"
sh=FBBE31F08E493A8B0702FE72F3ABA6DF996E20C6 ft=1 fh=1055b3d0ea15ac02 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="E:\Install\PDFCreator-1_7_2_setup.exe"
sh=86FD2D88F3C4675471D14644D2A2D8A0B08BA2F4 ft=1 fh=5d2300031434a965 vn="NSIS/StartPage.CC Trojaner" ac=I fn="E:\Install\VLC Media Player.exe"
|
FRST 32-Bit | FRST 64-Bit